CVE-2022-41674: Buffer Overflow
A buffer overflow flaw was found in the u8 overflow in cfg80211updatenotlistednontrans() in net/wireless/scan.c in the Linux kernel’s wifi subcomponent. This flaw allows an attacker to crash the system or leak internal kernel information.
Other sources
An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211bssinfoupdate function in net/mac80211/scan.c.
— Ubuntu
In cfg80211updatenotlistednontrans of scan.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
In the copy code of the elements, we do the following calculation to reach the end of the MBSSID element:
/ copy the IEs after MBSSID / cpylen = mbssid[1] + 2;
This looks fine, however, cpylen is a u8, the same as mbssid[1], so the addition of two can overflow. In this case the subsequent memcpy() will overflow the allocated buffer, since it copies 256 bytes too much due to the way the allocation and memcpy() sizes are calculated.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.0.2-1 - Upgrade
Upgrade
alpine/linux-ltsto a version that resolves this vulnerability.Fixed in 5.15.74-r0 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2023-01-05 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.19.16
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-41674?
CVE-2022-41674 is classified as a high-severity vulnerability due to its potential to cause system crashes and internal data leakage.
How do I fix CVE-2022-41674?
To fix CVE-2022-41674, update to kernel versions 5.10.223-1, 5.10.226-1, 6.1.123-1, or later remedied versions as specified by your distribution.
Which systems are affected by CVE-2022-41674?
CVE-2022-41674 affects multiple Linux kernel versions and distributions, including certain versions of Red Hat, Debian, and Fedora.
What are the possible impacts of exploiting CVE-2022-41674?
Exploiting CVE-2022-41674 can lead to a denial of service through system crashes and unintended exposure of sensitive kernel information.
Has CVE-2022-41674 been disclosed publicly?
Yes, CVE-2022-41674 has been publicly disclosed and is documented on various security platforms and repositories.